This message was sent to you at the request of ICRealtime Security Solutions LLC to notify you that the electronic shipment information below has been transmitted to UPS. The physical package(s) may or may not have actually been tendered to UPS for shipment. To verify the actual transit status of your shipment, click on the tracking link below or contact ICRealtime Security Solutions LLC directly.

This communication contains proprietary information and may be confidential. If you are not the intended recipient, the reading, copying, disclosure or other use of the contents of this e-mail is strictly prohibited and you are instructed to please delete this e-mail immediately.
Privacy Notice
Contact UPS

The malicious payload is at [donotclick]autobouracky.net/main.php?page=0e1cb9b71ef021b2 (report here) which is hosted on 173.208.252.207 (Datashack, US).

2 comments:

Nice catch. I've had a lot of spam offering "work from home" with reply addresses of @NewEngWork.com - The domain doesn't have a web server up but does have an MX record pointing at that same IP address